CVE-2019-7283
published 2019-01-31CVE-2019-7283: An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the…
PriorityP343high7.4CVSS 3.1
AVNACHPRNUINSUCNIHAH
EPSS
1.76%
75.8th percentile
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | netkit-rsh | < netkit-rsh 0.17-20 (bookworm) | netkit-rsh 0.17-20 (bookworm) |
| debian | netkit-rsh | — | — |
| mit | krb5-appl | <= 1.0.3 | — |
| netkit | netkit | <= 0.17 | — |
| netkit | netkit | — | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vg2g-72mx-mj33: netkit-rcp in rsh-client 0
ghsa_unreviewed·2023-07-15·CVSS 4.6
CVE-2023-38336 [MEDIUM] CWE-77 GHSA-vg2g-72mx-mj33: netkit-rcp in rsh-client 0
netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778.
OSV
CVE-2023-38336: netkit-rcp in rsh-client 0
osv·2023-07-14·CVSS 4.6
CVE-2023-38336 [MEDIUM] CVE-2023-38336: netkit-rcp in rsh-client 0
netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778.
GHSA
GHSA-hj6m-8794-335m: An issue was discovered in rcp in MIT krb5-appl through 1
ghsa_unreviewed·2022-05-24·CVSS 5.9
CVE-2019-25017 [MEDIUM] GHSA-hj6m-8794-335m: An issue was discovered in rcp in MIT krb5-appl through 1
An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Ker
GHSA
GHSA-2jpr-cg8h-wpp2: An issue was discovered in rcp in NetKit through 0
ghsa_unreviewed·2022-05-13·CVSS 5.9
CVE-2019-7283 [MEDIUM] GHSA-2jpr-cg8h-wpp2: An issue was discovered in rcp in NetKit through 0
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.
OSV
CVE-2019-7283: An issue was discovered in rcp in NetKit through 0
osv·2019-01-31·CVSS 5.9
CVE-2019-7283 [MEDIUM] CVE-2019-7283: An issue was discovered in rcp in NetKit through 0
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.
Debian
CVE-2023-38336: netkit-rsh - netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because ...
vendor_debian·2023·CVSS 4.6
CVE-2023-38336 [MEDIUM] CVE-2023-38336: netkit-rsh - netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because ...
netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778.
Scope: local
bookworm: open
bullseye: open
Red Hat
krb5-appl: Improper validation of object names allows malicious server to overwrite files via rcp client
vendor_redhat·2021-02-02·CVSS 5.9
CVE-2019-25017 [MEDIUM] CWE-20 krb5-appl: Improper validation of object names allows malicious server to overwrite files via rcp client
krb5-appl: Improper validation of object names allows malicious server to overwrite files via rcp client
An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upst
Red Hat
netkit-rsh: possible overwrite of arbitrary files by a malicious rsh server
vendor_redhat·2019-01-31·CVSS 5.9
CVE-2019-7283 [MEDIUM] netkit-rsh: possible overwrite of arbitrary files by a malicious rsh server
netkit-rsh: possible overwrite of arbitrary files by a malicious rsh server
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.
A vulnerability was found in rsh. The vulnerability occurs due to a possible overwrite of arbitrary files by a malicious rsh server. This flaw allows an attacker or a malicious rsh server (or a Man-in-The-Middle attacker) to overwrite arbitrary files in a directory on the rcp client machine.
Statement: Red Hat Enterprise Linux 6
Debian
CVE-2019-7283: netkit-rsh - An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the...
vendor_debian·2019·CVSS 5.9
CVE-2019-7283 [MEDIUM] CVE-2019-7283: netkit-rsh - An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the...
An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.
Scope: local
bookworm: resolved (fixed in 0.17-20)
bullseye: resolved (fixed in 0.17-20)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugs.debian.org/920486https://lists.debian.org/debian-lts-announce/2021/11/msg00016.htmlhttps://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txthttps://bugs.debian.org/920486https://lists.debian.org/debian-lts-announce/2021/11/msg00016.htmlhttps://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
2019-01-31
Published